CVE-2026-47831

HighCVSS 7.5

Published: 09/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The GenerateRandomPassword function in bosh-windows-stemcell-builder uses a cryptographically weak random number generator, allowing a remote attacker to brute-force the resulting SSH login via TCP/22. Affected versions are prior to v2019.98.

Risk Assessment

An attacker can gain control over a Windows virtual machine via remote SSH login, leading to data confidentiality and integrity breaches in the BOSH environment.

Recommendation

Immediately upgrade bosh-windows-stemcell-builder to version v2019.98 or later, and rotate all existing SSH passwords generated by the vulnerable version.

Other vulnerabilities in bosh-windows-stemcell-builder

CVE-2026-47830High
A vulnerability in the BOSH.Utils.psm1 script of bosh-windows-stemcell-builder allows low-privileged authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe. Upon service or system restart, an attacker can gain NT AUTHORITY\SYSTEM privileges, leading to full host control.

Original NVD description (English source)

Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows a remote attacker to brute-force the resulting SSH login via TCP/22. Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98.